Server, information processing system and information processing method

ABSTRACT

A vehicle that is an automatic driving vehicle acquires a control program for an ECU from a control center by wireless communication. A server includes a keyboard and mouse to accept handling by an operation manager that manages operation of the vehicle from outside of the vehicle, a display to present information to the operation manager, a communication IF configured to communicate with the control center, and a processor. The processor controls the display such that the display presents an update condition of the control program to the operation manager, when the control program is updatable. The processor control the communication IF such that the communication IF gives a notice of approval of update of the control program to the control center, when the keyboard and the mouse have accepted an operation manager’s handling for approving the update of the control program.

CROSS-REFERENCE TO RELATED APPLICATION

This application claims priority to Japanese Patent Application No.2021-174732 filed on Oct. 26, 2021, incorporated herein by reference inits entirety.

BACKGROUND 1. Technical Field

The present disclosure relates to a server and an information processingmethod. More specifically, the present disclosure relates to a serverthat manages the operation of an automatic driving vehicle, aninformation processing system that includes the server, and aninformation processing method for managing information relevant to theoperation of the automatic driving vehicle by the server.

2. Description of Related Art

Japanese Unexamined Patent Application Publication No. 2018-132979 (JP2018-132979 A) discloses a software update system that manages theupdate of software for a control device that is mounted on a vehicle.The system updates the software by wireless communication (so-calledover the air (OTA)).

SUMMARY

In the case where the software for electric equipment such as a personalcomputer and a smartphone is updated, the approval from a user is neededgenerally. Similarly, in the update of a control program for a controldevice mounted on a vehicle, there can be a case where the approval froma user is obtained in advance.

The inventors focused on the following problem that can occur about theautomatic driving vehicle. In a conventional vehicle, a driver is in avehicle cabin, and therefore it is only necessary to obtain the approvalof the update of the control program from the driver. Meanwhile, theoperation of an automatic driving vehicle can be managed from outside ofthe automatic driving vehicle. That is, in the automatic drivingvehicle, the operation manager is not always in the vehicle cabin.Accordingly, there can be a problem of the way to obtain the approval ofthe update of the control program. Such a situation is not discussed inJP 2018-132979 A at all.

The present disclosure has been made for solving the above problem, andan object of the present disclosure is to appropriately update thecontrol program for the control device mounted on the automatic drivingvehicle.

(1) A server according to an aspect of the present disclosure managesoperation of an automatic driving vehicle. The automatic driving vehicleis configured to acquire a control program from a control center bywireless communication, the control program being a control program fora control device that is mounted on the automatic driving vehicle. Theserver includes: an input device configured to accept handling by anoperation manager that manages the operation of the automatic drivingvehicle from outside of the automatic driving vehicle; an output deviceconfigured to present information to the operation manager; acommunication device configured to be capable of communicating with atleast one of the automatic driving vehicle and the control center; and aprocessor configured to control the input device, the output device andthe communication device. The processor controls the output device suchthat the output device presents an update condition of the controlprogram to the operation manager, when the control program is updatable.The processor controls the communication device such that thecommunication device gives a notice of approval of update of the controlprogram, to the at least one of the automatic driving vehicle and thecontrol center, when the input device has accepted an operationmanager’s handling for approving the update of the control program.

(2) The server may further include an authentication device configuredto authenticate the operation manager. The processor may control theoutput device such that the output device presents the update conditionto the operation manager that has been authenticated by theauthentication device.

(3) The processor may control the input device such that the inputdevice accepts handling by the operation manager that has beenauthenticated by the authentication device and does not accept handlingby a handling person that has not been authenticated by theauthentication device.

(4) The update condition may include a condition relevant to a time thatis required for the update of the control program.

(5) The update condition may include a condition relevant to a periodduring which the control program is updatable.

(6) The server may manage operation of a plurality of vehicles on eachof which a plurality of control devices is mounted. The update conditionmay include a condition for identifying a vehicle for which the controlprogram is updated, from the plurality of vehicles, and may include acondition for identifying a control device for which the control programis updated, from the plurality of control devices mounted on thevehicle.

(7) The update condition may include a condition relevant to a functionof the automatic driving vehicle that is updated by the control program.

(8) The update condition may include a condition relevant to a functionof the automatic driving vehicle that is restricted due to the update ofthe control program.

(9) The update condition may include a condition relevant to adisclaimer for the control center about a bug that is likely to begenerated due to the update of the control program.

(10) An information processing system according to another aspect of thepresent disclosure includes: the above server; and the automatic drivingvehicle.

(11) The automatic driving vehicle may acquire the control program fromthe control center, when the at least one of the automatic drivingvehicle and the control center has received the notice of the approvalof the update of the control program, and the automatic driving vehiclemay avoid acquiring the control program from the control center, whenthe at least one of the automatic driving vehicle and the control centerhas received a notice of rejection of the update of the control program.

(12) In an information processing method according to another aspect ofthe present disclosure, a server manages information relevant tooperation of an automatic driving vehicle. The automatic driving vehicleis configured to acquire a control program from a control center bywireless communication, the control program being a control program fora control device that is mounted on the automatic driving vehicle. Theinformation processing method includes a first step and a second step.The first step is a step in which the server presents an updatecondition of the control program to an operation manager, when thecontrol program is updatable, the operation manager managing theoperation of the automatic driving vehicle from outside of the automaticdriving vehicle. The second step is a step in which the server gives anotice of approval of update of the control program to at least one ofthe automatic driving vehicle and the control center, when the operationmanager has performed handling for approving the update of the controlprogram.

With the present disclosure, it is possible to appropriately update thecontrol program of the control device mounted on the automatic drivingvehicle.

BRIEF DESCRIPTION OF THE DRAWINGS

Features, advantages, and technical and industrial significance ofexemplary embodiments of the disclosure will be described below withreference to the accompanying drawings, in which like signs denote likeelements, and wherein:

FIG. 1 is a diagram showing a schematic configuration of an informationprocessing system according to an embodiment;

FIG. 2 is a block diagram showing a typical hardware configuration of avehicle;

FIG. 3 is a block diagram showing a typical hardware configuration of aserver;

FIG. 4 is a functional block diagram showing a functional configurationof the server that is relevant to the update of a control program;

FIG. 5 is a functional block diagram showing a functional configurationof the server that is relevant to start of traveling after the update ofthe control program;

FIG. 6 is a first flowchart for describing a flow of a process that isexecuted in the information processing system;

FIG. 7 is a diagram showing an example of an image that is displayed ona display before an inquiry to an operation manager about whether topermit the update of the control program;

FIG. 8 is a diagram showing an example of an image that is displayed onthe display at the time of the inquiry to the operation manager aboutwhether to permit the update of the control program;

FIG. 9 is a second flowchart for describing a flow of a process that isexecuted in the information processing system;

FIG. 10 is a diagram showing an example of an image that is displayed onthe display before an inquiry to a remote monitoring person aboutwhether to permit the start of the traveling of the vehicle; and

FIG. 11 is a diagram showing an example of an image that is displayed onthe display at the time of the inquiry to the remote monitoring personabout whether to permit the start of the traveling of the vehicle.

DETAILED DESCRIPTION OF EMBODIMENTS

An embodiment of the present disclosure will be described below indetail with reference to the drawing. In the figures, identical orcorresponding portions are denoted by identical reference characters,and descriptions therefor are not repeated.

Embodiment Schematic Configuration of Information Processing System

FIG. 1 is a diagram showing a schematic configuration of an informationprocessing system according to an embodiment. An information processingsystem 100 includes a server 1, a control center 2, and a plurality ofvehicles 3A, 3B, 3C. In the following, for convenience of description,an arbitrary vehicle of the vehicles 3A, 3B, 3C is referred to as avehicle 3. In FIG. 1 , three vehicles 3 are shown, but the number ofvehicles 3 is an arbitrary value.

For example, the server 1 is a server possessed by a business operator(a bus business operator, a taxi business operator, a ride-sharingservice business operator, or the like) that manages the operation ofthe vehicle 3. The server 1 may be a shared server possessed by aplurality of business operators that includes the business operator. Theserver 1 may be a cloud server provided by a cloud server managementcompany.

The server 1 is used not only by an operation manager of the vehicle 3but also by a remote monitoring person of the vehicle 3. For example,the operation manager is a staff (so-called superior manager) that worksat a business organizer to manage the operation of the vehicle 3 andthat has the authority to update a control program for the vehicle 3.The remote monitoring person is a staff (so-called operator) thatremotely monitors the vehicle 3 and that performs the handling of thevehicle 3 when appropriate. The operation manager and the remotemonitoring person are generally different persons, but may be the sameperson. In this example, description will be made assuming that theoperation manager and the remote monitoring person are differentpersons.

The control center 2 is a server of a business operator (for example, avehicle manufacture) that provides a control program for an electroniccontrol unit (ECU) 31 (see FIG. 2 ) that is mounted on the vehicle 3.

Each vehicle 3 is an automatic driving vehicle. Each vehicle 3 is usedin a service that is provided by the above business operator. The kind(vehicle type) of the vehicle 3 is selected when appropriate, dependingon the service that is provided by the business operator. In thisexample, the vehicle 3 is a bus. The server 1, the control center 2 andeach vehicle 3 are connected so as to be capable of communicating witheach other through a wired or wireless network NW.

Hardware Configuration of Vehicle

FIG. 2 is a block diagram showing a typical hardware configuration ofthe vehicle 3. The vehicle 3 includes an ECU 31, an automatic drivingsystem 32, a sensor group 33, a navigation system 34 and a datacommunication module (DCM) 35. The ECU 31, the automatic driving system32, the sensor group 33, the navigation system 34 and the DCM 35 areconnected with each other by a wired in-vehicle network such as acontroller area network (CAN) and Ethernet (R).

The ECU 31 includes a processor 311 and a memory 312. The memory 312includes a read only memory (ROM) 312A, a random access memory (RAM)312B and a flash memory 312C. The processor 311 controls the wholeaction of the vehicle 3 by executing the control program. The memory 312stores software that is executed by the processor 311. Particularly, theflash memory 312C stores the control program that is updated by OTA. Theflash memory 312C may be another rewritable non-volatile memory.

The ECU 31 controls apparatuses such that the vehicle 3 is in a desiredstate, in response to signals from the sensor group 33 and the like. TheECU 31 outputs commands for controlling various systems, in coordinationwith the automatic driving system 32. Although not illustrated, thevarious systems can include a brake system, a steering system, a powertrain system (for example, an electric parking brake system, a parkinglock system, a shift device and a motor generator), a body system (forexample, a direction indicator, a horn and a wiper), and the like.

The ECU 31 sends a variety of information indicating the state of thevehicle 3, to the server 1, and sends a variety of requests to theserver 1, through the DCM 35. Further, the ECU 31 receives commands ornotices from the server 1 through the DCM 35. In addition, in theembodiment, the ECU 31 receives (downloads) the control program from thecontrol center 2 through the DCM 35, and installs the downloaded controlprogram in the memory 312 at an appropriate timing. Then, the ECU 31activates the installed control program at an appropriate timing. TheECU 31 may be divided into a plurality of ECUs according to functions.In a later-described example (see FIG. 8 ), the ECU 31 includes a cameraECU.

The automatic driving system 32 is configured such that the automaticdriving of the vehicle 3 can be realized. The automatic driving is sucha control that the action of the vehicle 3 is executed without thedriving handling by a driver of the vehicle 3 (unmanned driving). Inthis example, the automatic driving system 32 is configured such thatthe fully automatic driving of the vehicle 3 can be performed. However,the automatic driving may include a control to assist the drivinghandling by the driver of the vehicle 3 at the time of the action of thevehicle 3, as exemplified by acceleration, deceleration and steering(manned driving). The automatic driving system 32 may be a part of theECU 31.

The sensor group 33 includes sensors (not illustrated) configured todetect the external situation of the vehicle 3, and includes sensors(not illustrated) configured to detect information corresponding to thetraveling state of the vehicle 3, a steering handling, an acceleratorhandling and a brake handling. Specifically, for example, the sensorgroup 33 includes a camera, a radar, a laser imaging detection andranging (LIDAR), a vehicle speed sensor, an acceleration sensor, and ayaw rate sensor (which are not illustrated).

The navigation system 34 includes a global positioning system (GPS)receiver (not illustrated). The GPS receiver identifies the position ofthe vehicle 3 based on electric waves from artificial satellites (notillustrated). The navigation system 34 executes a navigation process forthe vehicle 3, using the position information about the vehicle 3 thatis identified by the GPS receiver.

The DCM 35 is an in-vehicle communication module. The DCM 35 isconfigured to allow bidirectional data communication between the ECU 31and the server 1, and to allow bidirectional data communication betweenthe ECU 31 and the control center 2.

Hardware Configuration of Server

FIG. 3 is a block diagram showing a typical hardware configuration ofthe server 1. The server 1 includes a processor 11, a memory 12, akeyboard 13, a mouse 14, a camera 15, a display 16, and a communicationinterface (IF) 17. The memory 12 includes a ROM 121, a RAM 122 and ahard disk drive (HDD) 123. The processor 11, the memory 12, the keyboard13, the mouse 14, the camera 15, the display 16 and the communication IF17 are connected with each other by a bus.

The processor 11 controls the whole action of the server 1. The memory12 stores an operating system and application programs that are executedby the processor 11. The keyboard 13 and the mouse 14 accept inputs by auser. The camera 15 photographs a handling person of the server 1. Inthe embodiment, the handling person of the server 1 is the operationmanager or remote monitoring person of the vehicle 3. The display 16displays a variety of information to the handling person of the server1. The communication IF 17 is configured to allow communication betweenthe control center 2 and each vehicle 3.

At least one of the keyboard 13 and the mouse 14 corresponds to the“input device” according to the present disclosure. The “input device”may be a dedicated handling terminal for vehicle operation management, atouch panel, a microphone or the like. At least one of the display 16and the communication IF 17 corresponds to the “output device” accordingto the present disclosure. The “output device” may be a speaker, forexample. At least one of the keyboard 13, the mouse 14 and the camera 15corresponds to the “authentication device” according to the presentdisclosure.

Update of Control Program

In the case where the software for electric equipment such as a personalcomputer and a smartphone is updated, the approval from a user is neededgenerally. However, the operation of the vehicle 3 that is an automaticdriving vehicle is managed from outside of the vehicle 3, and thereforeno operation manager is in the vehicle cabin. Accordingly, there can bea problem of the way to obtain the approval of the update of the controlprogram.

In the embodiment, in the case where there is an updatable controlprogram, the server 1 (processor 11) displays the update condition ofthe control program on the display 16. Then, in the case where theoperation manager has performed handling for approving the update of thecontrol program to the keyboard 13 or the mouse 14, the server 1 gives anotice of the approval of the update of the control program, to thecontrol center 2 and/or the vehicle 3. The control center 2 and thevehicle 3 execute the update (OTA) of the control program by wirelesscommunication, when the control center 2 and the vehicle 3 have receivedthe notice of the approval. Thereby, even when no person is in thevehicle 3, it is possible to appropriately update the control program.

Functional Configuration of Server

FIG. 4 is a functional block diagram showing a functional configurationof the server 1 that is relevant to the update of the control program.The server 1 includes a communication unit 41, an arithmetic processingunit 42, an input unit 43, a display unit 44 and a photographing unit45. The arithmetic processing unit 42 is a functional block that isrealized when the processor 11 executes the operating system andapplication programs stored in the memory 12. The arithmetic processingunit 42 includes a communication control unit 421, a notification unit422, a handling acceptance unit 423, an image generation unit 424, astorage unit 425 and an authentication unit 426.

The communication unit 41 communicates with the outside (the controlcenter 2 and/or the vehicle 3). More specifically, the communicationunit 41 receives the update condition of the control program for the ECU31 of the vehicle 3, from the outside. Details of the update conditionwill be described later. Further, to the outside, the communication unit41 sends a notice indicating whether the operation manager of thevehicle 3 that has checked the update condition of the control programagrees to the update of the control program (approval/rejection). Thecommunication unit 41 corresponds to the communication IF 17 in FIG. 3 .

The communication control unit 421 controls the communication with theoutside through the communication unit 41. The communication controlunit 421 outputs the update condition of the control program that isreceived by the communication unit 41, to the image generation unit 424,and sends a notice that is generated by the notification unit 422, fromthe communication unit 41 to the outside.

The handling acceptance unit 423 outputs an input handling to the inputunit 43 by the operation manager of the vehicle 3, to the notificationunit 422 or the authentication unit 426. More specifically, the handlingacceptance unit 423 outputs, to the notification unit 422, a result (aresult of handling to a YES button or NO button in a later-describedexample) of the selection by the operation manager about whether toagree to the update of the control program. In addition, the handlingacceptance unit 423 can output a password input by the operationmanager, to the authentication unit 426. The input unit 43 correspondsto the keyboard 13 or the mouse 14 in FIG. 3 .

The image generation unit 424 generates an image indicating the updatecondition of the control program that is received by the communicationcontrol unit 421. Further, the image generation unit 424 generates animage on which the operation manager having checked the update conditionselects whether to agree to the update of the control program. Thedisplay unit 44 displays the image generated by the image generationunit 424, to the operation manager. The display unit 44 corresponds tothe display 16 in FIG. 3 .

The photographing unit 45 photographs the operation manager of thevehicle 3, and outputs the photographed image to the authentication unit426. The photographing unit 45 corresponds to the camera 15 in FIG. 3 .

The storage unit 425 stores data for authenticating the operationmanager of the vehicle 3. The technique for authenticating the operationmanager is not particularly limited, and various known techniques can beemployed. In this example, the storage unit 425 stores the featurequantity for face authentication of the operation manager. The storageunit 425 may store data for another biometric authentication(fingerprint authentication, iris authentication, voice authenticationor the like). The storage unit 425 may store the password set by theoperation manager.

The authentication unit 426 authenticates the operation manager based onthe image photographed by the photographing unit 45 and the featurequantity stored in the storage unit 425. The authentication unit 426 mayauthenticate the operation manager based on the password input to theinput unit 43 and the password stored in the storage unit 425. Theauthentication unit 426 outputs an authentication result to thenotification unit 422.

In the case where the authentication unit 426 recognizes that the server1 is being handled by an authorized operation manager registered inadvance, the notification unit 422 generates a notice indicating whetherthe operation manager agrees to the update of the control program. Morespecifically, in the case where the operation manager has performedhandling for agreeing to the update of the control program (in the casewhere the YES button has been pressed), the notification unit 422generates an update approval notice for the control program. On theother hand, in the case where the operation manager has performedhandling for rejecting the update of the control program (in the casewhere the NO button has been pressed), the notification unit 422generates an update rejection notice for the control program. The noticegenerated by the notification unit 422 is output to the communicationcontrol unit 421, and is sent from the communication unit 41 to theoutside.

FIG. 5 is a functional block diagram showing a functional configurationof the server 1 that is relevant to the start of the traveling after theupdate of the control program. The server 1 includes a communicationunit 51, an arithmetic processing unit 52, an input unit 53 and adisplay unit 54. Similarly to the arithmetic processing unit 42, thearithmetic processing unit 52 is a functional block that is realizedwhen the processor 11 executes the operating system and applicationprograms stored in the memory 12. The arithmetic processing unit 52includes a communication control unit 521, a notification unit 522, ahandling acceptance unit 523 and an image generation unit 524.

The communication unit 51 communicates with the outside. Thecommunication unit 51 receives the change content of the controlprogram, from the outside. Details of the change content will bedescribed later. Further, to the outside, the communication unit 41sends a notice indicating whether the remote monitoring person of thevehicle 3 that has checked the change content of the control programagrees to the driving start (driving restart) of the vehicle 3(permission/prohibition). The communication unit 51 corresponds to thecommunication IF 17 in FIG. 3 .

The communication control unit 521 controls the communication with theoutside through the communication unit 51. The communication controlunit 521 outputs the change content of the control program that isreceived by the communication unit 51, to the image generation unit 524,and sends a notice that is generated by the notification unit 522, fromthe communication unit 51 to the outside.

The handling acceptance unit 523 outputs an input handling to the inputunit 53 by the remote monitoring person of the vehicle 3, to thenotification unit 522. More specifically, the handling acceptance unit523 outputs, to the notification unit 522, a result (a result ofhandling to a YES button or NO button) of the selection by the remotemonitoring person about whether to agree to the update of the controlprogram.

The image generation unit 524 generates an image indicating the changecontent of the control program that is received by the communicationcontrol unit 521. Further, the image generation unit 524 generates animage on which the remote monitoring person having checked the changecontent selects whether to agree to the start of the traveling of thevehicle 3 after the update of the control program. The display unit 54displays the image generated by the image generation unit 524, to theremote monitoring person. The display unit 54 corresponds to the display16 in FIG. 3 .

The notification unit 522 generates a notice indicating whether theremote monitoring person agrees to the start of the traveling of thevehicle 3. More specifically, in the case where the remote monitoringperson has performed handling for agreeing to the start of the travelingof the vehicle 3 (in the case where the YES button has been pressed),the notification unit 522 generates a permission notice for the start ofthe traveling of the vehicle 3. On the other hand, in the case where theremote monitoring person has performed handling for rejecting the startof the traveling of the vehicle 3 (in the case where the NO button hasbeen pressed), the notification unit 522 generates a prohibition noticefor the start of the traveling of the vehicle 3. The notice generated bythe notification unit 522 is output to the communication control unit521, and is sent from the communication unit 51 to the outside.

Processing Flow

FIG. 6 is a first flowchart for describing a flow of a process that isexecuted in the information processing system 100. Flowcharts shown inFIG. 6 and FIG. 9 described later are executed at a preset timeinterval, for example. A process that is executed by the server 1 isshown on the left side, and a process that is executed by the controlcenter 2 is shown on the right side. The process on the right side maybe executed by the vehicle 3. This is because the control center 2 andthe vehicle 3 can communicates with each other and therefore a noticefrom the server 1 can reach the vehicle 3 through the control center 2and can reach the control center 2 through the vehicle 3. Each step isrealized by software processing, but may be realized by hardware(electric circuits). Hereinafter, “step” is referred to as “S”.

In S21, the control center 2 determines whether there is an updatablecontrol program for the ECU 31 of the vehicle 3. In the case where thereis an updatable control program (YES in S21), the control center 2 givesa notice indicating that there is an updatable control program, to theserver 1. On this occasion, the control center 2 further gives a noticeof the update condition (described later) of the control program, to theserver 1 (S22).

When the server 1 receives the notice from the control center 2, theserver 1 detects the handling person of the server 1, using the camera15, for example (S11). Then, the server 1 authenticates whether thehandling person of the server 1 is an authorized operation managerregistered in advance (S12). In the case where the handling person ofthe server 1 is authenticated (YES in S13), the server 1 displays theupdate condition of the control program on the display 16 (S14). Theserver 1 makes an inquiry to the operation manager about whether topermit the update of the control program. Then, the server 1 accepts theoperation manager’s handling relevant to whether to permit the update ofthe control program (S15).

FIG. 7 is a diagram showing an example of an image that is displayed onthe display 16 before the inquiry to the operation manager about whetherto permit the update of the control program. Before the inquiry to theoperation manager, each traveling situation of the plurality of vehicles3 (buses in this example) that is managed by the server 1 is displayedon an operation management screen of the display 16. More specifically,time, the traveling route name of the vehicle 3, the identificationnumber of the vehicle 3, and the status (the delay from a timeprescribed on a timetable, the decrease in state of charge (SOC), andthe like) of the vehicle 3 are displayed. Further, a map showing thecurrent place of each vehicle 3 on the traveling route is displayed onthe display 16.

FIG. 8 is a diagram showing an example of an image that is displayed onthe display 16 at the time of the inquiry to the operation manager aboutwhether to permit the update of the control program. At the time of theinquiry to the operation manager, a dialog box is displayed on thescreen shown in FIG. 7 . In the dialog box, for example, informationidentifying the targeted vehicle 3 (vehicle No. 1 in this example),information identifying the targeted ECU (camera ECU), a briefdescription (additional compatibility with video codec formats) aboutthe update content of the control program, a disclaimer (nothing inparticular) when the updated control program includes a bug, and afunction restriction (nothing in particular) due to the update of thecontrol program are displayed. In addition, in the dialog box, forexample, a scheduled update period (18:00 today to 8:00 tomorrow) forthe control program and a required update time (about 5 minutes) for thecontrol program are displayed.

The server 1 displays the above update condition, and then makes theinquiry about whether the operation manager of the vehicle 3 approvesthe update of the control program. In this example, in the case wherethe operation manager clicks a “YES” button, the update of the controlprogram is approved (permitted). On the other hand, in the case wherethe operation manager clicks a “NO” button, the update of the controlprogram is rejected (prohibited). By clicking a “CHECK DETAILS” button,the operation manager can check a more detailed content of each updatecondition before determining the approval or rejection of the update.

Back to FIG. 6 , in the case where the operation manager has performedthe handling for approving the update of the control program (YES inS16), the server 1 gives the notice of the approval of the update of thecontrol program, to the control center 2 (S18). When the control center2 receives the notice of the approval of the update (YES in S23), in thecase where a condition appropriate to the update of the control programhas been satisfied (for example, in the case where the vehicle 3 havingprovided an operation service has returned to a garage and has parked),the control center 2 executes the update (OTA) of the control program incoordination with the vehicle 3 (S24). That is, the control program isdownloaded from the control center 2 to the vehicle 3, and is installedin the flash memory 312C of the ECU 31.

On the other hand, in the case where the operation manager has performedthe handling for rejecting the update of the control program (NO in stepS16), the server 1 gives the notice of the rejection of the update ofthe control program, to the control center 2 (S17). In the case wherethe control center 2 has received the notice of the rejection of theupdate (NO in S23), the control center 2 does not execute the update(OTA) of the control program. Although not illustrated, also in the casewhere the handling for approving the update of the control program hasnot been performed in time, the control center 2 does not execute theupdate of the control program.

FIG. 9 is a second flowchart for describing a flow of a process that isexecuted in the information processing system 100. The process isexecuted after the control program is updated in accordance with thefirst flowchart shown in FIG. 6 .

In S41, the vehicle 3 determines whether a traveling start condition forthe vehicle 3 has been satisfied. For example, in the case where thecurrent time is near an operation start time about the vehicle 3 thatparks at the garage after the update of the control program, the vehicle3 determines that the traveling start condition for the vehicle 3 hasbeen satisfied. In the case where the traveling start condition for thevehicle 3 has been satisfied (YES in S41), the vehicle 3 gives thenotice of the change content of the control program, to the server 1(S42). This notice is given to the remote monitoring person that isdifferent from the operation manager.

The server 1 receives the notice from the vehicle 3, and then displaysthe change content of the control program on the display 16 (S31). Theserver 1 makes the inquiry to the remote monitoring person about whetherto permit the start of the traveling of the vehicle 3 after the updateof the control program. Then, the server 1 accepts the remote monitoringperson’s handling relevant to whether to permit the start of thetraveling of the vehicle 3 (S32).

FIG. 10 is a diagram showing an example of an image that is displayed onthe display 16 before the inquiry to the remote monitoring person aboutwhether to permit the start of the traveling of the vehicle 3. Beforethe inquiry to the remote monitoring person, the operation situation (ascheduled time and a record time for each bus stop in this example) ofthe targeted vehicle 3, the situation (for example, speed) of thevehicle 3, the switching of the driving mode of the vehicle 3, and thehandling (door opening or closing, emergency stop and the like) of thevehicle 3 are displayed, and pictures of the vehicle cabin of thevehicle 3 is displayed.

FIG. 11 is a diagram showing an example of an image that is displayed onthe display 16 at the time of the inquiry to the remote monitoringperson about whether to permit the start of the traveling of the vehicle3. At the time of the inquiry to the remote monitoring person, a dialogbox is displayed on the screen shown in FIG. 10 . In the dialog box, forexample, information identifying the targeted vehicle 3 (vehicle No. 1in this example), information identifying the targeted ECU (camera ECU),a brief description (additional compatibility with video codec formats)about the update content of the control program, a disclaimer (nothingin particular) when the updated control program includes a bug, and afunction restriction (nothing in particular) due to the update of thecontrol program are displayed.

In addition, in the dialog box, the change content (the number of videoscreens showing the picture photographed by an in-vehicle camera isincreased) of the control program is displayed. It is preferable thatthe function before the update of the control program and the functionafter the update of the control program be presented to the remotemonitoring person in a comparable manner in this way. Further, it ispreferable that information that is used when the remote monitoringperson monitors the vehicle 3 be particularly presented to the remotemonitoring person.

The server 1 displays the above change content, and then makes theinquiry about whether the remote monitoring person of the vehicle 3permits the traveling of the vehicle 3 after the update of the controlprogram. In this example, in the case where the remote monitoring personclicks a “YES” button, the traveling of the vehicle 3 is permitted. Onthe other hand, in the case where the remote monitoring person clicks a“NO” button, the traveling of the vehicle 3 is prohibited. By clicking a“CHECK DETAILS” button, the remote monitoring person can check a moredetailed content of the change content before determining the permissionor prohibition of the traveling.

Back to FIG. 9 , in the case where the remote monitoring person hasperformed the handling for permitting the start of the traveling of thevehicle 3 (YES in S33), the server 1 gives the notice of the permissionof the start of the traveling of the vehicle 3, to the vehicle 3 (S35).When the vehicle 3 receives the notice of the permission of the start ofthe traveling (YES in S43), the vehicle 3 starts the traveling (S44).For example, the vehicle 3 starts the traveling by activating thecontrol program installed in the flash memory 312C of the ECU 31.

On the other hand, in the case where the remote monitoring person hasperformed the handling for prohibiting the start of the traveling of thevehicle 3 (NO in S33), the server 1 gives the notice of the prohibitionof the start of the traveling of the vehicle 3, to the vehicle 3 (S34).In the case where the vehicle 3 has received the notice of theprohibition of the start of the traveling (NO in S43), the vehicle 3waits without starting the traveling.

As described above, in the embodiment, in the case where there is anupdatable control program for the ECU 31 of the vehicle 3, the controlcenter 2 (or the vehicle 3) makes the inquiry to the server 1 aboutwhether to permit the update of the control program. The server 1receives the inquiry, and then replies, to the control center 2 (or thevehicle 3), the result (approval or rejection) of the operationmanager’s handling relevant to whether to permit the update of thecontrol program. Thereby, it is possible to update the control programeven when a person having the authority to update the control programdoes not ride on the vehicle 3. Consequently, with the embodiment, it ispossible to appropriately update the control program for the ECU 31mounted on the vehicle 3.

Furthermore, in the embodiment, after the update of the control programfor the ECU 31 of the vehicle 3, the vehicle 3 makes the inquiry to theserver 1 about whether to permit the start of the traveling of thevehicle 3, together with the change content (change points of thecontrol, action, function and others of the vehicle 3) of the controlprogram. The server 1 receives the inquiry, and then replies, to thevehicle 3, the result (permission or prohibition) of the remotemonitoring person’s handling relevant to whether to permit the start ofthe traveling. Thereby, the remote monitoring person that does not rideon the vehicle 3 can know the change content of the control programbefore starting the traveling of the vehicle 3. Consequently, with theembodiment, it is possible to appropriately operate the vehicle 3 afterthe update of the control program.

It should be understood that the embodiment disclosed herein is anexample and is not limitative in every respect. It is intended that thescope of the present disclosure is shown not by the above embodiment butby the claims and includes all modifications in meanings and rangesequivalent to the claims.

What is claimed is:
 1. A server that manages operation of an automaticdriving vehicle, the automatic driving vehicle being configured toacquire a control program from a control center by wirelesscommunication, the control program being a control program for a controldevice that is mounted on the automatic driving vehicle, the servercomprising: an input device configured to accept handling by anoperation manager that manages the operation of the automatic drivingvehicle from outside of the automatic driving vehicle; an output deviceconfigured to present information to the operation manager; acommunication device configured to be capable of communicating with atleast one of the automatic driving vehicle and the control center; and aprocessor configured to control the input device, the output device andthe communication device, the processor controlling the output devicesuch that the output device presents an update condition of the controlprogram to the operation manager, when the control program is updatable,the processor controlling the communication device such that thecommunication device gives a notice of approval of update of the controlprogram, to the at least one of the automatic driving vehicle and thecontrol center, when the input device has accepted an operationmanager’s handling for approving the update of the control program. 2.The server according to claim 1, further comprising an authenticationdevice configured to authenticate the operation manager, wherein theprocessor controls the output device such that the output devicepresents the update condition to the operation manager that has beenauthenticated by the authentication device.
 3. The server according toclaim 2, wherein the processor controls the input device such that theinput device accepts handling by the operation manager that has beenauthenticated by the authentication device and does not accept handlingby a handling person that has not been authenticated by theauthentication device.
 4. The server according to claim 1, wherein theupdate condition includes a condition relevant to a time that isrequired for the update of the control program.
 5. The server accordingto claim 1, wherein the update condition includes a condition relevantto a period during which the control program is updatable.
 6. The serveraccording to claim 1, wherein: the server manages operation of aplurality of vehicles on each of which a plurality of control devices ismounted; and the update condition includes a condition for identifying avehicle for which the control program is updated, from the plurality ofvehicles, and includes a condition for identifying a control device forwhich the control program is updated, from the plurality of controldevices mounted on the vehicle.
 7. The server according to claim 1,wherein the update condition includes a condition relevant to a functionof the automatic driving vehicle that is updated by the control program.8. The server according to claim 1, wherein the update conditionincludes a condition relevant to a function of the automatic drivingvehicle that is restricted due to the update of the control program. 9.The server according to claim 1, wherein the update condition includes acondition relevant to a disclaimer for the control center about a bugthat is likely to be generated due to the update of the control program.10. An information processing system comprising: the server according toclaim 1; and the automatic driving vehicle.
 11. The informationprocessing system according to claim 10, wherein: the automatic drivingvehicle acquires the control program from the control center, when theat least one of the automatic driving vehicle and the control center hasreceived the notice of the approval of the update of the controlprogram; and the automatic driving vehicle does not acquire the controlprogram from the control center, when the at least one of the automaticdriving vehicle and the control center has received a notice ofrejection of the update of the control program.
 12. An informationprocessing method in which a server manages information relevant tooperation of an automatic driving vehicle, the automatic driving vehiclebeing configured to acquire a control program from a control center bywireless communication, the control program being a control program fora control device that is mounted on the automatic driving vehicle, theinformation processing method comprising: a step in which the serverpresents an update condition of the control program to an operationmanager, when the control program is updatable, the operation managermanaging the operation of the automatic driving vehicle from outside ofthe automatic driving vehicle; and a step in which the server gives anotice of approval of update of the control program to at least one ofthe automatic driving vehicle and the control center, when the operationmanager has performed handling for approving the update of the controlprogram.